[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] PHP Worm traffic?

To: list@xxxxxxxxxxxxx
Subject: Re: [LUG] PHP Worm traffic?
From: Tom <madtom1999@xxxxxxxxxxxxxx>
Date: Tue, 17 Dec 2013 11:41:39 +0000
Delivered-to: dclug@xxxxxxxxxxxxxxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type; bh=bkCSAVunJPUWWeP+HWk+ueEwsyIEZmKw6mtpsPCBP2U=; b=lIEkai99LHXKYM2mwGZYNDDqWia2fIEavuEUgQlBTagU/ugX2J5b9+J6yi2h9Aj4dC HjmJOFyIXKkax8rH1VZ12PNNYhb7a2wglo5vSu0P6Vjvj/s7IHFYZoH1XbR2jCSZkM6w rRkkr8m1a9IirP5IVrR5dyCH0loiiRzWsQTgSfY1PiFRtHpz+dXGXigbZhHfl/6kxw0x U6LvzN8LsIniFAEfX45hhhJ1Fsu1WEok3MDPYxWdbKM2ToYa62Fr+XR04Mbt3uw4d4RX XGaGbKxDixhwA0g+pJrPmWt9/FExW77xCPDnDRGiQhddaYS17tYSExsaJzIMZDP3rC8C qOlg==

On 17/12/13 11:15, Simon Waters wrote:

My log reporting flagged up increase in requests for php, php5, php-cgi, php.cgi, php4 from all over the net, trying old PHP exploit method.

This looks like the likely candidate:

http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices

Since it requires a vulnerable PHP from circa May 2012 I'm not worried about my servers, but I know some take a more reactive approach to patching and upgrades (oops).

Bit concerned about possible embedded PHP but again all my devices are patched as far as vendors have released fixes.

At the volumes I'm seeing this is not a big threat to the Internet, but interesting.

Now when is the "interesting" OpenSSL vuln being announced......

http://www.theregister.co.uk/2013/12/17/fake_firefox_addon_target_hunting_botnet/ ??
Tom te tom te tom

-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq

Follow-up: Re: [LUG] PHP Worm traffic?
- From: Martijn Grooten

References:
- [LUG] PHP Worm traffic?
  - From: Simon Waters

Prev by Date: [LUG] PHP Worm traffic?
Next by Date: Re: [LUG] PHP Worm traffic?
Previous by thread: [LUG] PHP Worm traffic?
Next by thread: Re: [LUG] PHP Worm traffic?
Index(es):
- Date
- Thread